New Electrum vulnerability? Unknown transaction (Fraud, Theft) 4.3.4 AppImage

[btcfreak123]

I had a strange issue with a BTC transfer. When i broadcasted a (small) transaction from my address/coin (which I marked as "spend" in the coins tab) - at the same time -  another transaction initiated with a very large amount from my other coin address in the same wallet to an unknown address and the funds were moved 1h later from there to a Binance address.

I am 99% sure I don't have any malware / viruses / keyloggers etc. (all checked multiple times, even rootkit scanners) on my (Debian/Linux) system and also the AppImage I have used many times before and after (!) that "hack" without problems and is originally from Electrum.org and GPG-verified! I also never downloaded or updated (by phishing messages etc.) any other version.

The weired thing is something just drained my second BTC address but not the other ones in the same wallet (with the same password!)

My fear is that there is a new (unkonwn) vulnerability of Electrum out that allows malicious servers to inject code as in the old JSON-RPC port vulnerability (prior to 3.0.4). A malware on my PC also would have drained all BTC addresses entirely and not just picked a single one or at least would have repeatedly tried to initiate transactions, but I have used the same electrum program and wallet and addresses after this attack without issues.

The second transaction was initiated at the same time I have entered my wallet password (to sign my TX) and hit "broadcast".

Has anoybody had a similar case?

If it was a "electrum stealer program" - how do they work exactly and what programs are known/discovered? Is the above described behaviour typical for such a software or a malicious Electrum server?

[goldkingcoiner]

I had a strange issue with a BTC transfer. When i broadcasted a (small) transaction from my address/coin (which I marked as "spend" in the coins tab) - at the same time -  another transaction initiated with a very large amount from my other coin address in the same wallet to an unknown address and the funds were moved 1h later from there to a Binance address.

I am 99% sure I don't have any malware / viruses / keyloggers etc. (all checked multiple times, even rootkit scanners) on my (Debian/Linux) system and also the AppImage I have used many times before and after (!) that "hack" without problems and is originally from Electrum.org and GPG-verified! I also never downloaded or updated (by phishing messages etc.) any other version.

The weired thing is something just drained my second BTC address but not the other ones in the same wallet (with the same password!)

My fear is that there is a new (unkonwn) vulnerability of Electrum out that allows malicious servers to inject code as in the old JSON-RPC port vulnerability (prior to 3.0.4). A malware on my PC also would have drained all BTC addresses entirely and not just picked a single one or at least would have repeatedly tried to initiate transactions, but I have used the same electrum program and wallet and addresses after this attack without issues.

The second transaction was initiated at the same time I have entered my wallet password (to sign my TX) and hit "broadcast".

Has anoybody had a similar case?

If it was a "electrum stealer program" - how do they work exactly and what programs are known/discovered? Is the above described behaviour typical for such a software or a malicious Electrum server?

Since you scanned for malware/viruses, I am guessing that your device is clean so it's probably nothing to do with that.

But it does sound suspiciously like a private key leak or a malicious server (man-in-the-middle attack).

Check Electrum's log file, if you had logging enabled: ~/.electrum/logs/ or \AppData\Roaming\Electrum\logs (hidden folder)
Was auto-connect to server on?  
Check the tx data on blockchain explorer - were they broadcast from the same IP / node?

[BitMaxz]

I don't think Electrum servers can able to do that since Electrum only request for these data like address history and balances, block headers, UTXOs, etc.
There's no way that they can do or control your wallet.

How exactly did you create your wallet? Did you create your wallet somewhere else? I mean outside the Electrum wallet from that PC/Laptop?

If not, and you created your wallet on the same device, there's a possibility there's something in your PC that you don't know leaks your wallet private keys.

I'd like to know how you installed this Linux and where you downloaded it. Are you sure that you downloaded the Linux OS from a legit source?
Because if you downloaded it from somewhere other than the trusted source, there's a possibility it's already infected with malware. Scanning it with any antivirus won't work; that's why I don't download an OS randomly.

There are lots of free OS mods out there, but all of them are already infected with malware that can't be easily scanned by any antivirus.

If I want to use a wallet on a Linux-based OS, I am more comfortable using Tails, which has built-in Electrum. Electrum already provided a guide for this. If you are interested in the future, check their guide below.

- https://github.com/spesmilo/electrum-docs/blob/master/tails.rst

[btcfreak123]

Since you scanned for malware/viruses, I am guessing that your device is clean so it's probably nothing to do with that.

But it does sound suspiciously like a private key leak or a malicious server (man-in-the-middle attack).

Check Electrum's log file, if you had logging enabled: ~/.electrum/logs/ or \AppData\Roaming\Electrum\logs (hidden folder)
Was auto-connect to server on?  
Check the tx data on blockchain explorer - were they broadcast from the same IP / node?

Unfortunately I had logging not enabled but yes, it was auto-connected to (several) servers.

Blockchain explorers also show no IP addresses, so how would I check where both TX came from or if they initiated both on my PC/wallet or not? This would already help me. If the second TX was initiated outside my wallet (e.g. by a stolen seed or private key) this would rule out malware on my current system, since I have used the same wallet years ago on a Windows system - where I also had only signature-verified Electrum progs installed, but I am not so sure (as on my Linux system now) that I was 99% free of malware. But then again, why would someone with my wallet seed had not drained all the addresses but only one and coincidentally at the exact same time when I broadcasted a TX and never before or after?

B.t.w. I discovered that at the time of the attack - shortly (seconds/minutes) before - 3 files were created in the /.electrum directory:
/.electrum/certs/guichet.centure.cc
/.electrum/certs/blackie.c3-soft.com
/.electrum/certs/btc.aftrek.org

Idk if this is normal (e.g. new servers connected) or could that have been the malicious servers?

I don't think Electrum servers can able to do that since Electrum only request for these data like address history and balances, block headers, UTXOs, etc.
There's no way that they can do or control your wallet.

How exactly did you create your wallet? Did you create your wallet somewhere else? I mean outside the Electrum wallet from that PC/Laptop?

If not, and you created your wallet on the same device, there's a possibility there's something in your PC that you don't know leaks your wallet private keys.

I'd like to know how you installed this Linux and where you downloaded it. Are you sure that you downloaded the Linux OS from a legit source?
Because if you downloaded it from somewhere other than the trusted source, there's a possibility it's already infected with malware. Scanning it with any antivirus won't work; that's why I don't download an OS randomly.

There are lots of free OS mods out there, but all of them are already infected with malware that can't be easily scanned by any antivirus.

If I want to use a wallet on a Linux-based OS, I am more comfortable using Tails, which has built-in Electrum. Electrum already provided a guide for this. If you are interested in the future, check their guide below.

- https://github.com/spesmilo/electrum-docs/blob/master/tails.rst

I have created the wallet on a Windows system years ago - see my post above.

The Debian OS (iso install. file) I have downloaded of course from the original Debian developer site debian.org - also signature-verified.
I now use offline signing with Electrum (cold wallet) and only one wallet per address - so fuck the seed :-) Tails is also a good option, I agree, but only when using it as read-only / non-persistent storage and if you do offline signing, otherwise you still have a hot wallet.

But what really is driving me nuts is that I don't know how the hack worked and why only once at this time and coincidentally with a TX of myself? My old wallet seed and BTC addresses and even the Electrum password never changed in 5 years and any attacker could have stolen much more if he had known the seed/keys/password. I really think it is a combination of a glitch / vulnerability in Electrum together with a malicious server... Any server can send wrong confirmations, tricking you into downloading an update, but I am pretty sure I didn't fall for that. Maybe anything else? There was this JSON-RPC hack, you remember, not so long ago...

B.t.w. I have contacted Binance - where my stolen BTC ended up on one of their addresses - and after proving (with screenshots, videos from wallet opening and wallet/TX history) that I am the owner of the address from which the BTC got stolen, they offered to refund me - but only if I open a Binance account (they will send it to my Binance address)! They said the owner of this Binance BTC address (obviously their customer=the hacker!) agreed to send it back!!! WTF Has anyone had this experience? The don't want to give me his identity nor the type of attack how the BTCs got removed! This looks very dodgy and supports my theory of a malicious server attack / vulnerability in Electrum which they maybe want to hide... Also I think a criminal/police investigation over several jurisdictions (me, Binance HQ, Binance server locations, TX server locations / mining pool, location of Binance customer) would lead to nothing.

[nc50lc]

B.t.w. I have contacted Binance - where my stolen BTC ended up on one of their addresses - and after proving (with screenshots, videos from wallet opening and wallet/TX history) that I am the owner of the address from which the BTC got stolen, they offered to refund me - but only if I open a Binance account (they will send it to my Binance address)! They said the owner of this Binance BTC address (obviously their customer=the hacker!) agreed to send it back!!! WTF Has anyone had this experience?

This doesn't sound like a reputable Customer service, are you certain that you're talking to Binance?

If you can confirm it, then that's one good news already but it's certain that they'll ask for KYC data before returning the funds to you.

Has anyone had this experience? The don't want to give me his identity nor the type of attack how the BTCs got removed! This looks very dodgy and supports my theory of a malicious server attack / vulnerability in Electrum which they maybe want to hide...

Normally, they wont provide you anything about the hacker without the police/authorities' intervention.

For the attack vector, it's impossible for them to know which Electrum/PC vulnerability the hacker utilized to steal your bitcoins.
They aren't the developers of Electrum and auditing the code for unnoticed bugs is hard even for its developer.

Here's the list of vulnerabilities, click each for the affected versions: github.com/spesmilo/electrum/security
(of course, unnoticed/unreported bugs aren't included)

[pooya87]

B.t.w. I discovered that at the time of the attack - shortly (seconds/minutes) before - 3 files were created in the /.electrum directory:
/.electrum/certs/guichet.centure.cc
/.electrum/certs/blackie.c3-soft.com
/.electrum/certs/btc.aftrek.org

Idk if this is normal (e.g. new servers connected) or could that have been the malicious servers?

These are Electrum server certificates that are used to encrypt your communication with them using SSL (somewhat similar to how you communicate with a website using https). All servers must have them and they send it to you so that you can encrypt/decrypt the messages with that server.

There are no known vulnerability that a "malicious" server can exploit to gain access to your keys though.

[BitMaxz]

I have created the wallet on a Windows system years ago - see my post above.

If it was created from Windows, then I guess your wallet was already compromised at that time using Windows. Because it's a rare case that your current Linux is infected if it was newly installed. Linux is considered more secure than the other OS, but it's not completely immune. If you don't randomly access any website with that OS, it should be clean, and I believe someone already has full control of your wallet since you created it from Windows OS.

For now, there's no way to recover those stolen BTC, but maybe since you already contacted Binance and they said they are going to refund stolen funds, it's worth trying.
However, I'm sure Binance will demand some data, including a sign message and your identity.

[goldkingcoiner]

B.t.w. I have contacted Binance - where my stolen BTC ended up on one of their addresses - and after proving (with screenshots, videos from wallet opening and wallet/TX history) that I am the owner of the address from which the BTC got stolen, they offered to refund me - but only if I open a Binance account (they will send it to my Binance address)! They said the owner of this Binance BTC address (obviously their customer=the hacker!) agreed to send it back!!! WTF Has anyone had this experience? The don't want to give me his identity nor the type of attack how the BTCs got removed! This looks very dodgy and supports my theory of a malicious server attack / vulnerability in Electrum which they maybe want to hide... Also I think a criminal/police investigation over several jurisdictions (me, Binance HQ, Binance server locations, TX server locations / mining pool, location of Binance customer) would lead to nothing.

Gotta be honest, that is the strangest thing I have ever heard of. Maybe the hacker is not actually a hacker and there was some sort of mix-up? Or maybe it was a hacker and he just got scared because he got tracked down to a centralized exchange where his KYC data is known.

And you are right to say something is dodgy, I would investigate further, if I were you and I would not hesitate to get the authorities involved, if you truly think that you caught a really dumb hacker...

Something is definitely fishy here....

But I am glad that you are getting your coins back.

[Cricktor]

Linux is mostly more secure because it's less on the radar of malware writers due to it's lower market share than Windows. This is oversimplified for sure, but imagine you're a malware developer: for which platform would you craft your malware, one with large user base or one with significantly smaller user base?

@OP: do you mind posting the transactions, I understand you that there should be two of them? How did you determine that your presumably stolen funds went to Binance?

~~~

I'm sorry but this sounds like fairy tales and I hardly believe anything of this.

[BitBastard]

Could it be someone physically in your immediate surrounding area, who is capturing your network traffic and modifying packets mid-stream?